Code Smell 261 - DigiCert Underscores

This is your reminder: Don't forget to check strings with special characters like underscores

TL;DR: Underscore and special characters can lead to validation errors

Problems

• Incomplete Validation
• Security Risks
• Missed Tests
• Incorrect Setup
• System Inconsistency
• Breaking changes with legacy data

Solutions

1. Use consistent prefix
2. Implement strict validation
3. Check system outputs
4. Create migration tests
5. Test with legacy data

Context

In digital certificate validation, ensuring domain control is critical. An incomplete validation and potential security issues.

DigiCert recently encountered such a problem, where they missed adding an underscore prefix. This resulted in certificates being issued without proper validation and a cascade of broken sites with few advancement notices.

Sample Code

Wrong

// Incorrect random value without underscore
let random_value = format!("{}", generate_random_value());
setup_dns_record(
  &format!("_{}.example.com", random_value),
  "dcv.digicert.com");

Right

// Correct random value with underscore
let random_value = format!("_{}", generate_random_value());
setup_dns_record(&random_value, "dcv.digicert.com");

Detection

• [x]Manual

You can detect this smell by reviewing the validation process and checking if all required prefixes are consistently applied.

You should also store historical data and check the new rules applied to them.

Tag(s)

• Security

Level

• [x]Advanced

AI Generation

AI-generated code might miss adding specific prefixes unless explicitly instructed.

This can lead to security risks if the generated code is not thoroughly reviewed.

AI Detection

With proper examples and instructions, AI tools can be trained to detect missing prefixes in generated or existing code.

Conclusion

Skipping an essential part of the validation process, like an underscore prefix, can lead to significant issues.

Ensuring such steps are consistently applied and reviewed is crucial for maintaining system integrity and security.

Relations

More Info

Security is a process, not a product

Bruce Schneier